As malicious threat actors continue to evolve their tactics, techniques, and procedures (TTPs), the people tracking them down continue to learn and pursue these cybercriminals.
SecureWorld News has reported on multiple success stories when it comes to law enforcement fighting back against ransomware.
The most recent win for the good guys fighting ransomware threat actors comes from Europol, who successfully took out a VPN service, known as VPNLab.net, that was used by criminals to distribute ransomware, malware, and other types of cyberattacks.
Joint operation takes down VPNLab.net
Europol was able to shutdown VPNLab.net through cooperative efforts with authorities from 10 countries, including Germany, Netherlands, Canada, Czech Republic, France, Hungary, Latvia, Ukraine, the United Kingdom, and the United States.
Europol reports that authorities seized or disrupted 15 servers that hosted VPNLab.net's service, rendering it no longer available.
The investigation uncovered over 100 organizations who have been identified as "at risk" to cyberattacks, and authorities are working directly with these potential victims to mitigate any exposure.
The Head of Europol's European Cybercrime Centre, Edvardas Šileris, discussed the successful joint operation:
"The actions carried out under this investigation make clear that criminals are running out of ways to hide their tracks online. Each investigation we undertake informs the next, and the information gained on potential victims means we may have pre-empted several serious cyberattacks and data breaches."
Volker Kluwe, Chief of the Hanover Police Department, shared further:
"One important aspect of this action is also to show that, if service providers support illegal action and do not provide any information on legal requests from law enforcement authorities, that these services are not bulletproof. This Operation shows the result of an effective cooperation of international law enforcement agencies, which makes it possible to shut down a global network and destroy such brands."
What made VPNLab.net popular?
VPNLab.net offered services based on OpenVPN technology and 2048-bit encryption, allowing cybercriminals to remain anonymous. It also provided double VPN and had servers in multiple countries, making it almost impossible for law enforcement to detect.
The service also only cost as little as $60 a year.
Europol describes how the Dark Web service caught the attention of authorities:
"Law enforcement took interest in the provider after multiple investigations uncovered criminals using the VPNLab.net service to facilitate illicit activities such as malware distribution. Other cases showed the service's use in the setting up of infrastructure and communications behind ransomware campaigns, as well as the actual deployment of ransomware. At the same time, investigators found the service advertised on the dark web itself."
Thanks to the efforts from Europol and the 10 countries involved in the investigation, VPNLab.net will no longer provide cybercriminals with a safe space to operate.
See the report from Europol for more information.
